Army Pfc. Bradley Manning is escorted from a security vehicle to a courthouse in Fort Meade, Maryland, on Monday, Dec. 19, 2011. Photo: Patrick Semansky/AP
FT. MEADE, Maryland — A day after a government forensic expert testified that he’d found thousands of diplomatic cables on the Army computer of suspected WikiLeaks source Bradley Manning, he was forced to admit under cross-examination that none of the cables he compared to the ones WikiLeaks released matched.
Special Agent David Shaver, a forensic investigator with the Army’s Computer Crimes Investigations Unit, testified Sunday that he’d found 10,000 U.S. diplomatic cables in HTML format on the soldier’s classified work computer, as well as a corrupted text file containing more than 100,000 complete cables that had been converted to base-64 encoding.
Six months after Manning was arrested for allegedly leaking documents to WikiLeaks, the site began publishing 250,000 U.S. diplomatic cables that ranged in date from December 1966 to the end of February 2010. But Shaver said none of the documents that he found on Manning’s computer, and that he then compared to those that WikiLeaks published, matched the WikiLeaks documents.
Shaver wasn’t asked how many cables he compared to the WikiLeaks cables, or which dates those cables had, he just said he matched “some of them.” In re-direct examination, however, he noted that the CSV file in which the cables were contained was corrupted and suggested this might indicate that it had not been possible to pass those cables to WikiLeaks for this reason. The defense objected to this assumption, however, noting that Shaver could not speculate on why the cables were not among those released by WikiLeaks.
The cross-examination of Shaver focused on establishing that there might have been legitimate reasons for the State Department cables to be on Manning’s computers, since intelligence analysts were given access to them to do their job. One of Manning’s superiors testified earlier in the hearing that he had sent a link to Manning and other analysts directing them to the location where they could find the cables.
The defense also established that it’s possible Manning’s computer could have been used by someone else — it was already established in previous testimony that he shared his work computers with another soldier — and also raised questions about the possibility that other soldiers knew Manning’s password and therefore could have logged into his computer using his credentials and user profile.
In addition to the State Department cables found on Manning’s computer, Shaver also testified Sunday that he’d found links between evidence on Manning’s laptop and two other WikiLeaks releases: the so-called “Collateral Murder” Apache helicopter video and Gitmo prisoner assessments.
Last April, WikiLeaks began publishing a trove of more than 700 Guantanamo Bay prisoner assessment reports.
Shaver discovered scripts for Wget — a web-scraping tool — on Manning’s computer that pointed to a Microsoft SharePoint server holding copies of the Gitmo documents. He ran the scripts to download the documents, then downloaded the ones that WikiLeaks had published, compared them and found they were the same, Shaver testified.
He also said he found two copies of the Apache video on Manning’s work computer in unallocated space.
But Shaver was forced to admit on Monday that he was not aware that soldiers in the secure facility Manning worked in had been viewing that controversial video and talking about in December 2009, months before WikiLeaks published it. That, the defense seemed to suggest, would explain why a copy might be on Manning’s computer.
A second government forensic witness, a private contractor named Mark Johnson who works for Mantech International, testified that he examined the forensic image of Manning’s personal laptop, a Macbook Pro. On that computer he discovered chat logs of conversations that Manning allegedly had with former hacker Adrian Lamo. Johnson revealed that the Adium chat program was installed on Manning’s computer and was used to conduct the chat with Lamo.
In a screen shot of the chat log shown in court, Manning’s name was completely spelled out, as opposed to Lamo’s version of the chat logs — which the hacker gave authorities in May 2010 — and showed Manning’s chats under the name Bradass87.
Manning’s former roommate at Forward Operating Base Hammer also testified on Monday to say that he and Manning shared a room from October 2009, when they first deployed to Iraq, up until the time Manning was arrested in May 2010.
Specialist Eric Baker, a military police officer, said that he and Manning rarely talked. But he told the court that Manning “used the computer quite often” and said that when he’d wake up in the middle of the night Manning would be on the computer. He never saw what was on Manning’s screen, he told the court.